Auth‑precondition exists: an authenticated attacker who possesses a valid Inbox‑compatible JWT can supply a specially crafted converter XML to the builder.SaveFile() API. By inserting a duplicate m_sFileTo element, the attacker overrides the server‑generated output path and writes arbitrary files outside the designated job directory. This allows the attacker to overwrite the runtime.json configuration file, modify the Document Builder executable path and its arguments, and trigger arbitrary operating system commands when the next Document Builder job runs. The flaw results in uncontrolled code execution and full system compromise.

ONLYOFFICE Document Server versions earlier than 10.0.0 are affected. Only deployments of these pre‑10 releases are at risk, while v10.0.0 and later incorporate the fix.

The CVSS score of 8.7 denotes high severity, and an EPSS score of 1% indicates a low probability of exploitation in the wild, but does not confirm that exploitation has occurred. It is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated session with a correctly signed JWT, meaning the attacker must have legitimate access to the system; the attack vector is therefore through the authenticated builder.SaveFile() endpoint. Once the path overwrite is performed, executing the job delivers remote code execution privileges for the ds service account.